Splunk Search

How to replace any multi values found in search result with true and if the value is null replace with No

vinaykataaig
Explorer

Hi there!
I am updating my question:
Below is the scenario where I wanted to see what are the servers got patched since last 3 months. My query pulls up the below table showing server name and patches installed by month and if there is not patched installed for that specific month i did a fill null values to show as "Not Patched". By doing this we just wanted to check if the server is patched for that month or not, we don't need the patch names to be shown.So I wanted to replace all those patch names to some other values like "True"/Patched/yes.

alt text

0 Karma
1 Solution

mayurr98
Super Champion

Try this :

index="oswin" sourcetype="windowsupdatelog" "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED" 
| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)" 
| eval server = Upper(mvindex(split(host,"."),-0)) 
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N") 
| eval day = strftime(start, "%a") 
| eval Month = Upper(date_month) 
| replace * WITH "Patched" IN ApplicablePatch 
| chart values(ApplicablePatch) as ApplicablePatch by server Month 
| fillnull value="Not Patched"

OR

index="oswin" sourcetype="windowsupdatelog" "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED" 
| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)" 
| eval server = Upper(mvindex(split(host,"."),-0)) 
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N") 
| eval day = strftime(start, "%a") 
| eval Month = Upper(date_month) 
| chart values(ApplicablePatch) as ApplicablePatch by server Month 
| fillnull value="Not Patched" 
| foreach JANUARY FEBRUARY MARCH APRIL MAY JUNE JULY AUGUST SEPTEMBER OCTOBER NOVEMBER DECEMBER 
    [ eval <<FIELD>>=if(<<FIELD>>="Not Patched","Not Patched","Patched")]

View solution in original post

0 Karma

mayurr98
Super Champion

Try this :

index="oswin" sourcetype="windowsupdatelog" "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED" 
| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)" 
| eval server = Upper(mvindex(split(host,"."),-0)) 
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N") 
| eval day = strftime(start, "%a") 
| eval Month = Upper(date_month) 
| replace * WITH "Patched" IN ApplicablePatch 
| chart values(ApplicablePatch) as ApplicablePatch by server Month 
| fillnull value="Not Patched"

OR

index="oswin" sourcetype="windowsupdatelog" "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED" 
| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)" 
| eval server = Upper(mvindex(split(host,"."),-0)) 
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N") 
| eval day = strftime(start, "%a") 
| eval Month = Upper(date_month) 
| chart values(ApplicablePatch) as ApplicablePatch by server Month 
| fillnull value="Not Patched" 
| foreach JANUARY FEBRUARY MARCH APRIL MAY JUNE JULY AUGUST SEPTEMBER OCTOBER NOVEMBER DECEMBER 
    [ eval <<FIELD>>=if(<<FIELD>>="Not Patched","Not Patched","Patched")]
0 Karma

vinaykataaig
Explorer

Actually First search worked for me. Thank you!!
And also i thought of doing it another way as well, Just by writing eval logic if the count(Applicable Patch) >"0" then show Patched if the value is null then Not patched.

| replace * WITH "Patched" IN ApplicablePatch
| chart values(ApplicablePatch) as ApplicablePatch by server Month
| fillnull value="Not Patched"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What is your query? What exactly do you want replaced with "True/Yes"?

---
If this reply helps you, Karma would be appreciated.
0 Karma

vinaykataaig
Explorer

Thanks for the response, I have updated my question.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share your query.

---
If this reply helps you, Karma would be appreciated.
0 Karma

vinaykataaig
Explorer

index="oswin" sourcetype="windowsupdatelog" |search "Patch Deployment" AND "AGENT_INSTALLING_SUCCEEDED"

| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)"
| eval server = Upper(mvindex(split(host,"."),-0))
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N")
| eval day = strftime(start, "%a")
| eval Month = Upper(date_month)
| chart values(ApplicablePatch) as ApplicablePatch by server Month | fillnull value="Not Patched"

0 Karma

mayurr98
Super Champion

I have updated my answer pls try if it doesn't work then could you provide the splunk query to get this result?

0 Karma
Get Updates on the Splunk Community!

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

[Coming Soon] Splunk Observability Cloud - Enhanced navigation with a modern look and ...

We are excited to introduce our enhanced UI that brings together AppDynamics and Splunk Observability. This is ...